Last updated: August 24, 2026. Customers notified at least 30 days before changes take effect.
| Sub-Processor | Category | Processing Purpose | Data Types | Region / Safeguard |
|---|---|---|---|---|
| Amazon Web Services (AWS) DPA | Cloud infrastructure | Server hosting and compute (EC2) | All user and organization data | A single EU region, GDPR-adequate |
| Paddle Billing DPA | Payment / Merchant of Record | Subscription billing, payment processing, refund management | Billing address, subscription state (card data never enters Usherfly systems) | Paddle's own infrastructure — MoR via Estonian OÜ entity |
| Transactional email provider | Email delivery | Onboarding notifications, system emails, account alerts | Email address, name, notification content | Provider selection within GL-5 scope; DPA link to be added upon selection |
| PostHog DPA | Product analytics | Usage pattern analysis, feature adoption tracking, consent-gated session replay | Pseudonymous event data (no IP capture), masked session recordings | EU data region (eu.i.posthog.com) — GDPR-adequate |
| Sentry DPA | Error tracking | Technical error monitoring, performance tracking | Error stack traces, platform context (personal data minimized) | EU data region — GDPR-adequate |
| Anthropic (Claude) DPA | AI | AI onboarding flow generation (suspended, D-190) | Admin-provided flow description, role, and context text (admins are instructed not to include onboardee personal data in these fields). Nothing from the generation is retained: no prompt, no role, no draft. The only thing kept is an aggregate counter that holds no personal data. | Active from June 14 to August 24, 2026; during that period data was transferred to this US sub-processor under an asserted Standard Contractual Clauses (SCC) safeguard per the Anthropic Commercial Terms, but execution of those SCCs was never confirmed. The feature was suspended on August 24, 2026 and the transfer has ceased; it will not resume until our self-hosted EU model ships. |
| OpenAI DPA | AI | AI onboarding flow generation (suspended, D-190) | Admin-provided flow description, role, and context text (admins are instructed not to include onboardee personal data in these fields). Nothing from the generation is retained: no prompt, no role, no draft. The only thing kept is an aggregate counter that holds no personal data. | Active from June 14 to August 24, 2026; during that period data was transferred to this US sub-processor under an asserted Standard Contractual Clauses (SCC) safeguard per the OpenAI DPA, but execution of those SCCs was never confirmed. The feature was suspended on August 24, 2026 and the transfer has ceased; it will not resume until our self-hosted EU model ships. |
| Google (OAuth / Workspace) DPA | Authentication | Authentication / sign-in identity | Name, email, Google account id | United States — transferred under Standard Contractual Clauses (SCCs) via the Google Cloud DPA; consent at sign-in (Google OAuth) |
| SMS providers (Twilio, İletimerkezi) | SMS delivery | Delivery of transactional onboarding messages and opt-in marketing messages by SMS | Phone number, message content | Region / transfer mechanism to be finalized before go-live — a GDPR-adequate safeguard will be in place; DPA link to be added on go-live |
| WhatsApp provider (planned) | WhatsApp messaging | Delivery of transactional onboarding messages and opt-in marketing messages over WhatsApp | Phone number, message content | Provider selection to be finalized before go-live — a GDPR-adequate safeguard will be in place; DPA link to be added upon selection |
Questions: [email protected]
Security disclosure: If you have found a security vulnerability, please report it to [email protected]. We review reports and respond in line with responsible-disclosure principles.
Data Processing Agreement